CVE-2026-126460 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 concatenates the CLP01 claim control number from uploaded X12 835 ERA files into a SQL query without escaping. A user with billing write access can upload a crafted file that is stored and triggers a time-based SQL injection when reprocessed, extracting patient health information.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR install before 8.5.0 where users with billing write access can upload ERA (835) files through the eligibility or EOB search pages. Installs that do not process ERA files or that restrict billing write access to trusted staff have a smaller exposure, but the sources do not say whether those paths are reachable by default.
Not affected if no-billing-write-access, openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
version.php and compare against 8.5.08.5.0 or laterOpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.